topic How extract field and value using rex? in Splunk Search

How extract field and value using rex?

karthi2809 — Fri, 31 Mar 2023 02:39:40 GMT

29-Mar-2023 04:56:35:PM: |CPU Utilization % Average ------- 11

Expected result:

Re: How extract field and value using rex?

ITWhisperer — Fri, 31 Mar 2023 05:24:13 GMT

| rex "(?<expected>\d+)$"

Re: How extract field and value using rex?

karthi2809 — Fri, 31 Mar 2023 06:38:24 GMT

@ITWhisperer

rex field=_raw "MemoryUsage %(?<MemoryUtilization>[^']+)"

MY result is

------------ 41.4

expected result

41.4

Re: How extract field and value using rex?

ITWhisperer — Fri, 31 Mar 2023 06:58:45 GMT

If you move the goal posts by providing different examples, you can expect the solution to break. Try something like this (based on the two examples given so far!)

| rex "(?<expected>[\d\.]+)$"